# Copyright (C) 2016 Justaguy @ Cybersprint B.V.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.

import re

from lib.cuckoo.common.abstracts import Signature

class Exploit_zteF460F660(Signature):
    name = "exploit_zteF460-F660"
    description = "Attempts to exploit CVE-2014-2321, a DNS change vulnerability in ZTE F460/F660 routers"
    severity = 3
    categories = ["http"]
    authors = ["Cybersprint"]
    minimum = "2.0"
    families = ["exploit"]
    dnsserver1_re = "sendcmd\\s+1\\s+DB\\s+set\\s+DHCPSHostCfg\\s+0\\s+DNSServers1\\s+(([0-9]{1,3}\\.){3}[0-9]{1,3})"
    dnsserver2_re = "sendcmd\\s+1\\s+DB\\s+set\\s+DHCPSHostCfg\\s+0\\s+DNSServers2\\s+(([0-9]{1,3}\\.){3}[0-9]{1,3})"
    targetpage_re = "(([a-z0-9\\.-]+)\/web_shell_cmd.gch)"

    def on_complete(self):
        for http in getattr(self, "get_net_http_ex", lambda: [])():
            httpbody = open(http["path"], "rb").read()

            dnsserver1 = re.search(self.dnsserver1_re, httpbody, re.S | re.I)
            if dnsserver1:
                self.mark_ioc("DNS1", dnsserver1.group(1))

            dnsserver2 = re.search(self.dnsserver2_re, httpbody, re.S | re.I)
            if dnsserver2:
                self.mark_ioc("DNS2", dnsserver2.group(1))

            targetpage = re.search(self.targetpage_re, httpbody, re.S | re.I)
            if targetpage:
                self.mark_ioc("TargetRouter", targetpage.group(1))

        return self.has_marks()
